netcat Johannes Franken

Size: px

Start display at page:

Download "netcat Johannes Franken"

Nickolas Douglas
6 years ago
Views:

1 netcat Johannes Franken On this page I show example uses of netcat - a command line tool to create network connections over tcp or udp. Contents 1. Intended purpose 2. Usage as client a) Querying webservers b) Forwarding ports c) Talking to mailrelays d) Determining a remote DNS server s software 3. Usage as server a) Remote shell demon b) Capturing network traffic c) Copying directory trees over some internet 4. Usage as portscanner 5. Links to advanced topics Intended purpose With netcat you can talk to arbitrary tcp- or udp-connections via stdin/out, e.g. from a shellscript. netcat can either setup the connections itself (client-mode): or answer them (server-mode): Additionally netcat s client-mode can be used as a portscanner. The following documentation correlates to netcat 1.10 from , which still is the most up to date version today (2003). Page: 1

2 Page: 2

3 Usage as client Querying webservers Try it yourself: When you query a webserver using shell redirection, telnet won t wait for the server s response, but abort the connection at the end of it s input: $ printf GET / HTTP/1.0\n\n telnet 80 Trying Connected to localhost. Escape character is ^]. Connection closed by foreign host. $ netcat performs better: $ printf GET / HTTP/1.0\n\n nc -w HTTP/ OK Server: thttpd/2.21b 23apr2001 Content-Type: text/html; charset=iso [...] <HTML> [...] </HTML> netcat will quit on the time when the connection closes down. the BTW: The parameter -w 10 makes sure, that this happens maximum 10 seconds the after the the input has ended. Forwarding ports With netcat and inetd you can forward local ports to other hosts. The following line in /etc/inetd.conf on host2 will locally provide host 3 s port stream tcp nowait nobody /usr/bin/nc /usr/bin/nc -w 3 host3 80 If you like logging and access control, you can change the first /usr/bin/nc to /usr/sbin/tcpd. Talking to mailrelays In my talk about ssh-tunnelling you can see a config file for exim, which forwards mails to certain domains over a mail relay using ssh and netcat: Page: 3

4 # at bottom of TRANSPORT CONFIGURATION : ########################### # Transport, which tunnels mails over ssh to my smarthost ssh: driver = pipe # talk regular smtp to the pipe (qmail approved :-) ) bsmtp = all bsmtp_helo = true use_crlf = true prefix = " suffix = " # connect to my mail server s smtp port. # must authenticate without password command = ssh johannes.our-isp.org netcat -w 1 localhost smtp user = jfranken # ssh failure handling: kill hanging sessions, # retry and tell me on failures timeout = 300s temp_errors = 1 return_fail_output = true # at top of ROUTERS CONFIGURATION: ########################### t_online: driver = domainlist transport = ssh route_list = "^t-online\.(de at com) t-dialin\.net$ ;\ ^mail.com$ ;\ ^lists.sourceforge.net$ ;\ ^bigpond.com$ ;\ ^aol.com$ ;\ ^mathematik.tu-darmstadt.de$ ;" The interesting point about this configuration is the cognition, that I can use any host, for which I have ssh access, as a mail relay. Determining a remote DNS server s software You can remotely determine the software a remote DNS server is running on: $ version.bind. txt CHAOS grep -i "^V" VERSION.BIND. 0S CHAOS TXT "BIND 8.3.4" Of course, you can also do that with bash and netcat: $ whatdns() { printf begin-base \np8ibaaabaaaaaaaab3zlcnnpb24eymluzaaaeaadcg==\n==== uudecode nc -uw 1 $1 domain strings tail -1; } $ whatdns pns.dtag.de BIND $ whatdns Page: 4

5 Usage as server When you type PROGRAM nc -l -p PORT -w TIMEOUT or nc -l -p PORT -w TIMEOUT PROGRAM 1. netcat will wait for exactly one connection to port PORT, then 2. attach to PROGRAM s out- or input and 3. wait maximum TIMEOUT seconds for the connection to abort. For ports below 1024, you need to be root. If the port should be bidirectional (do input as well as output), you can type nc -l -p PORT -e PROGRAM Unfortunately netcat cannot pass parameters to PROGRAM, so you might need to supply a 2-lines shellscript in most cases. Because netcat quits at the end of the connection, it can only service one connection. Use the following 3-lines shellscript, if you want netcat to accept multiple (successive or concurrent) sessions: $ cat << EOF >mydemon #!/bin/bash export port=${port:-$1} # inherit $1 as $port nc -l -p $port -e $0 & # await further connections on this port [ $1 ] PROGRAM # do the work (not for the first invocation) EOF $ chmod +x mydemon $./mydemon 3000 $ The -e parameter will only work, if netcat has been compiled with the option -DGAPING_SECURITY_HOLE set. For Debian GNU/Linux 3.0, this is true. Remote shell demon With the following shellscript, you can start your personal remote shell demon: Page: 5

6 #!/bin/bash # pershd - personal shell demon # Johannes Franken - jfranken@jfranken.de # on first invocation, export $PW and $port to subshells export PW port if [ $1 ] ; then port=$1 echo -n pass: read PW fi # do we know the port to listen on? if [! $port ]; then echo USAGE: $0 port ; exit; fi # wait for further connections (veiling params) echo "-l -p $port -e $0" nc 2>/dev/null & [ $1 ] && exit; # first invocation exit here # ask for password unset p until [ "$p" = "$PW" ]; do echo -n pass: read p done # received good password. present a shell bash --noediting -i When I start this script, it asks me to tell it a password and then waits for connections in the background: jfranken@tp:~$./pershd 1234 pass:secret jfranken@tp:~$ With this password I can now access my shell from remote hosts: $ nc tp.jfranken.de 1234 pass:secret jfranken@tp:~$ jfranken@tp:~$ exit exit $ Capturing network traffic Sniffing tools like tcpdump, snoop, iptraf or ethereal are quite popular for debugging network applications. But in order to use them, you need to be root. With netcat you can also capture network connections as a normal user: just point your application to a local netcat, which loggs everything and then forwards it to the server. Page: 6

7 To do so, just replace the term PROGRAM in the above mydemon-script with netcat -o /tmp/sniffer. date +%s.$$ tp.jfranken.de 80 and call it with parameter netcat will now create a logfile for each access to that port in your /tmp-directory. For example: After I had opened with my browser, there was the following logfile: $ cat /tmp/sniffer > f f 31 2e 31 0d 0a # GET / HTTP/1.1.. > d e 74 3a 20 4f # User-Agent: Oper > f 36 2e c 69 6e e # a/6.11 (Linux 2. [...] < f 31 2e f 4b 0d # HTTP/ OK. < a a f #.Server: thttpd/ < e d # 2.21b 23apr2001. < a 43 6f 6e e 74 2d a #.Content-Type: t [...] < a 3c 2f d e 0a 3c 2f 48 #.</FRAMESET>.</H < d 4c 3e 0a # TML>. Copying directory trees over some internet With netcat, (gnu)tar and bash, you can copy directory trees from one host to another. The files are transfered compressed and with all their attributes (permissions/modification times). To receive a file, I let netcat listen on port 51330, and redirect it s output to a tar: $ alias receive= nc -vlp tar xzvp $ receive listening on [any] On the sending host you call a shell function, which tars the given files/directories and sends them to port at the receiving host. $ send() { j=$*; tar cpz ${j/%${!#}/} nc -w 1 ${!#} 51330;} $ send dir* tp.jfranken.de For those not familiar with bash-o-magic: ${!#} returns the last parameter (the hostname), ${j/%${!#}/} any others (list of files or directories). Page: 7

8 Usage as portscanner Used like this, netcat will test some host for open ports: nc -vz PARAMETER hostname PORTRANGES Possible values for PARAMETER are: Parameter Meaning -v show the closed ports as well -w <seconds> timeout for connection setup -u udp instead of tcp. Best used together with -w -r try the ports in random order -i <seconds> delay after each tested port Examples for a tcp- and an udp-scan: $ nc -vz [ ] 443 (https) open [ ] 110 (pop3) open [ ] 80 (www) open [ ] 53 (domain) open [ ] 25 (smtp) open [ ] 22 (ssh) open $ $ nc -vz -vur -i 1 -w 2 localhost localhost [ ] 1024 (?) open localhost [ ] 109 (pop2) : Connection refused localhost [ ] 112 (?) : Connection refused localhost [ ] 111 (sunrpc) open localhost [ ] 110 (pop3) : Connection refused localhost [ ] 108 (?) : Connection refused sent 0, rcvd 0 Links to advanced topics The netcat(1) manpage The netcat README file Page: 8

netcat Гарчиг Tuguldur BiBO

netcat Гарчиг Tuguldur BiBO netcat Tuguldur BiBO Гарчиг 1. Хэрэглээ 2. Client (Удирдагч)-с холбогдох a. Webserver-тэй холбогдох b. Port дамжуулах c. Ямар Software DNS-Server ажиллаж байгааг мэдэх 3. Server-н өмнөөс